@sixb/core 0.1.11 → 0.1.12

package/src/actions/validation.ts

@@ -1,10 +1,7 @@
-import type { JsonValue } from "../json"
-import type { SchemaOrRef, ValueType } from "../ontology"
+import type { ValueType } from "../ontology"
 import { OntologyValidationError } from "../ontology/errors"
-import { validateSchemaOrRefValue } from "../ontology/refs"
 import type { ObjectTypeWithPropertyTokens } from "../ontology/tokens"
-import type { Schema } from "../ontology/types"
-import { coerceSchemaValueToTyped, normalizeSchemaValue } from "../ontology/validation"
+import { coerceParamsToTyped, normalizeParams } from "../shared/params/validation"
 import type { ActionRunParams } from "../storage/action-runs"
 import { ActionDefinitionError } from "./errors"
 import type {
@@ -55,53 +52,10 @@ export function normalizeActionParams(
   params: Record<string, unknown>,
   pathPrefix: string
 ): ActionRunParams {
-  const knownParamIds = new Set(Object.keys(paramsConfig))
-  const normalized: Record<string, JsonValue> = {}
-
-  for (const paramId of Object.keys(params)) {
-    if (!knownParamIds.has(paramId)) {
-      throw new OntologyValidationError(`Unknown param '${paramId}' for action '${pathPrefix}'`)
-    }
-  }
-
-  for (const [paramId, paramDef] of Object.entries(paramsConfig)) {
-    const value = params[paramId]
-
-    if (value === undefined) {
-      if (paramDef.required) {
-        throw new OntologyValidationError(
-          `Missing required param '${paramId}' for action '${pathPrefix}'`
-        )
-      }
-      continue
-    }
-
-    if (value === null) {
-      if (!paramDef.nullable) {
-        throw new OntologyValidationError(
-          `[Sixb] Action param ${pathPrefix}.${paramId} cannot be null`
-        )
-      }
-      normalized[paramId] = null
-      continue
-    }
-
-    validateSchemaOrRefValue(
-      paramDef.schema,
-      value,
-      `${pathPrefix}.${paramId}`,
-      runtime.ontology.getValueTypesById()
-    )
-
-    normalized[paramId] = normalizeSchemaOrRefValue(
-      paramDef.schema,
-      value,
-      `${pathPrefix}.${paramId}`,
-      runtime.ontology.getValueTypesById()
-    )
-  }
-
-  return normalized
+  return normalizeParams(runtime.ontology.getValueTypesById(), paramsConfig, params, {
+    kind: "action",
+    id: pathPrefix,
+  })
 }
 
 /**
@@ -115,21 +69,7 @@ export function coerceActionParamsToTyped(
   params: Record<string, unknown>,
   valueTypesById: ReadonlyMap<string, ValueType>
 ): Record<string, unknown> {
-  const coerced: Record<string, unknown> = { ...params }
-
-  for (const [paramId, paramDef] of Object.entries(paramsConfig)) {
-    const value = params[paramId]
-    if (value === undefined) continue
-
-    const schema = paramDef.schema
-    if (typeof schema === "object" && schema !== null && schema.type === "objectRef") {
-      continue
-    }
-
-    coerced[paramId] = coerceSchemaValueToTyped(schema as Schema, value, valueTypesById)
-  }
-
-  return coerced
+  return coerceParamsToTyped(paramsConfig, params, valueTypesById)
 }
 
 export function validateActionSubject(action: ActionDefinition, subject: ActionSubject): void {
@@ -168,20 +108,3 @@ function actionAppliesToObjectType(
     .listForType(objectType)
     .some((candidate) => candidate.id === action.id)
 }
-
-function normalizeSchemaOrRefValue(
-  schema: SchemaOrRef,
-  value: unknown,
-  path: string,
-  valueTypesById: ReadonlyMap<string, ValueType>
-): JsonValue {
-  if (typeof schema === "object" && schema !== null && schema.type === "objectRef") {
-    const refValue = value as { objectTypeId: string; primaryId: string }
-    return {
-      objectTypeId: refValue.objectTypeId,
-      primaryId: refValue.primaryId,
-    }
-  }
-
-  return normalizeSchemaValue(schema as Schema, value, path, valueTypesById)
-}

package/src/agents/errors.ts

@@ -40,6 +40,9 @@ export type AgentRequestErrorCode =
   | "authority_not_inheritable"
   | "invalid_context"
   | "storage_unavailable"
+  | "sandbox_not_configured"
+  | "invalid_sandbox_params"
+  | "sandbox_execution_unavailable"
 
 /**
  * Raised by {@link requestAgentRun} (the trigger). Callers branch on `code` rather than message text

package/src/agents/execution.ts

@@ -5,6 +5,7 @@ import { resolveRuntimeAuthorizationForProject } from "../execution/authorizatio
 import type { ModelCatalog } from "../models"
 import { resolveExecutionCosts } from "../runtime/ai-cost"
 import { resolveExecutionUsage } from "../runtime/ai-usage"
+import type { SixbDependencies } from "../runtime/sixb"
 import type { SixbRuntimeContext } from "../runtime/types"
 import type {
   AgentThreadRecord,
@@ -17,7 +18,7 @@ import type {
 import type { AiCostSummary } from "../storage/ai-cost"
 import type { AiModelCallUsage } from "../storage/ai-usage"
 import { AgentRequestError } from "./errors"
-import { createAgentThreadId } from "./ids"
+import { createAgentThreadId, createAgentThreadSandboxName } from "./ids"
 import {
   type RequestAgentRunInput,
   type RequestAgentRunResult,
@@ -25,24 +26,41 @@ import {
   retryAgentRun,
 } from "./request"
 import { assertNoAgentSelector } from "./retired-config"
+import { normalizeSandboxBinding } from "./sandbox"
 import type { AgentDescriptor } from "./types"
 
 export type ExecutionAgentRequestInput = Omit<RequestAgentRunInput, "principal">
+
+/** Execution ownership tokens never leave the storage/worker boundary. */
+function publicThread(thread: AgentThreadRecord): AgentThreadRecord {
+  if (!thread.sandboxState) return thread
+  const { name, status, initialized } = thread.sandboxState
+  return { ...thread, sandboxState: { name, status, initialized } }
+}
 export type ListExecutionAgentThreadsInput = Omit<
   ListAgentThreadsInput,
   "projectId" | "ownerPrincipal"
 >
 
-export interface CreateExecutionAgentThreadInput {
+export type CreateExecutionAgentThreadInput<
+  TParams extends Record<string, unknown> = Record<string, unknown>,
+> = {
   readonly id?: string
   readonly title?: string
+  readonly sandbox?: TParams
 }
 
-export interface AgentThreadsRuntime {
-  create(input: CreateExecutionAgentThreadInput): Promise<AgentThreadRecord>
-  getById(threadId: string): Promise<AgentThreadRecord | null>
-  list(input?: ListExecutionAgentThreadsInput): Promise<ListAgentThreadsResult>
-}
+export type AgentThreadsRuntime<TParams extends Record<string, unknown> = Record<string, unknown>> =
+  {
+    /** Start fresh after uncertain recovery; never deletes the previous sandbox. */
+    recreateSandbox(
+      threadId: string,
+      input: { readonly expectedSandboxName: string }
+    ): Promise<AgentThreadRecord>
+    create(input: CreateExecutionAgentThreadInput<TParams>): Promise<AgentThreadRecord>
+    getById(threadId: string): Promise<AgentThreadRecord | null>
+    list(input?: ListExecutionAgentThreadsInput): Promise<ListAgentThreadsResult>
+  }
 
 export interface AgentRunsRuntime {
   request(input: ExecutionAgentRequestInput): Promise<ExecutionAgentRunResult>
@@ -71,18 +89,21 @@ export interface ExecutionAgentRunResult extends Omit<RequestAgentRunResult, "ru
   readonly run: AgentRunView
 }
 
-export interface AgentRuntime {
+export type AgentRuntime<TParams extends Record<string, unknown> = Record<string, unknown>> = {
   /** Null when no language models are configured or the caller cannot run the Agent. */
   get(): AgentDescriptor | null
-  readonly threads: AgentThreadsRuntime
+  readonly threads: AgentThreadsRuntime<TParams>
   readonly runs: AgentRunsRuntime
 }
 
-export function createAgentRuntime(
+export function createAgentRuntime<
+  TParams extends Record<string, unknown> = Record<string, unknown>,
+>(
   runtime: SixbRuntimeContext,
   execution: ExecutionContext,
-  models?: ModelCatalog
-): AgentRuntime {
+  models?: ModelCatalog,
+  sandbox?: SixbDependencies["sandbox"]
+): AgentRuntime<TParams> {
   const authority = resolveRuntimeAuthorizationForProject(runtime)
   const principal = authority.type === "principal" ? authority.context.principal : SYSTEM_PRINCIPAL
   const allowed = () => isRuntimeAllowed(runtime, { kind: "agent.run" })
@@ -97,12 +118,12 @@ export function createAgentRuntime(
     if (!thread || !allowed()) return null
     return authority.type === "principal" && !principalsEqual(principal, thread.ownerPrincipal)
       ? null
-      : thread
+      : publicThread(thread)
   }
 
   const getAgent = (): AgentDescriptor | null => {
     if (authority.type === "denied" || authority.type === "delegated") return null
-    const model = models?.language.default
+    const model = models?.language?.default
     if (!model || !allowed()) return null
     return {
       name: "Sixb",
@@ -130,6 +151,25 @@ export function createAgentRuntime(
   return {
     get: getAgent,
     threads: {
+      recreateSandbox: async (threadId, input) => {
+        const thread = await getVisibleThreadRecord(threadId)
+        if (!thread)
+          throw new AgentRequestError("thread_not_found", "[Sixb] Agent thread not found.")
+        const storage = runtime.storage.agents
+        if (!storage)
+          throw new AgentRequestError(
+            "storage_unavailable",
+            "[Sixb] Agent storage is not configured."
+          )
+        const sandboxState = await storage.threads.transitionSandbox({
+          projectId: runtime.projectId,
+          id: threadId,
+          action: "recreate",
+          expectedSandboxName: input.expectedSandboxName,
+          name: createAgentThreadSandboxName(runtime.projectId, threadId),
+        })
+        return publicThread({ ...thread, sandboxState })
+      },
       create: async (input) => {
         assertNoAgentSelector(input)
         const agent = getAgent()
@@ -143,7 +183,18 @@ export function createAgentRuntime(
             "[Sixb] Agent storage is not configured."
           )
         }
+        if (input.sandbox !== undefined && !sandbox?.supportsPersistence) {
+          throw new AgentRequestError(
+            "sandbox_not_configured",
+            "[Sixb] Thread sandboxes require a provider with persistence support."
+          )
+        }
+        const binding =
+          input.sandbox === undefined
+            ? undefined
+            : normalizeSandboxBinding(sandbox?.definition, input.sandbox, runtime.ontology)
         return storage.threads.create({
+          ...(binding === undefined ? {} : { sandboxParams: binding }),
           id: input.id ?? createAgentThreadId(),
           projectId: runtime.projectId,
           ownerPrincipal: principal,
@@ -158,11 +209,12 @@ export function createAgentRuntime(
         }
         const storage = runtime.storage.agents
         if (!storage || !allowed()) return { threads: [], hasMore: false, total: 0 }
-        return storage.threads.list({
+        const result = await storage.threads.list({
           ...input,
           projectId: runtime.projectId,
           ownerPrincipal: authority.type === "principal" ? principal : undefined,
         })
+        return { ...result, threads: result.threads.map(publicThread) }
       },
     },
     runs: {

package/src/agents/ids.ts

@@ -10,6 +10,14 @@ export function createAgentThreadId(): string {
   return `agt_thr_${randomUUID()}`
 }
 
+/** A fresh provider name, scoped to one project's thread; never a filesystem revision. */
+export function createAgentThreadSandboxName(projectId: string, threadId: string): string {
+  const digest = createHash("sha256")
+    .update(JSON.stringify([projectId, threadId, randomUUID()]))
+    .digest("hex")
+  return `sixb-sb-${digest}`
+}
+
 export function createAgentRunId(): string {
   return `agt_run_${randomUUID()}`
 }

package/src/agents/index.ts

@@ -78,6 +78,7 @@ export {
   createAgentRunExecutionToken,
   createAgentRunId,
   createAgentThreadId,
+  createAgentThreadSandboxName,
   createSubagentExecutionId,
   createSubagentRunId,
 } from "./ids"

package/src/agents/request.ts

@@ -114,6 +114,7 @@ export async function requestAgentRun(
     principal,
   })
 
+  assertSandboxExecutionAvailable(thread)
   // Fast single-flight check for a clear error. `runs.create` below is the atomic authority.
   if (thread.activeRunId !== null) {
     throw new AgentRequestError(
@@ -203,6 +204,7 @@ export async function retryAgentRun(
       `[Sixb] Agent thread '${failedRun.threadId}' was not found.`
     )
   }
+  assertSandboxExecutionAvailable(thread)
   const runId = createAgentRunId()
   const durableExecution = await prepareDurableAgentExecution(runtime, execution, runId)
   await assertAiLimitPreflight(runtime, durableExecution)
@@ -236,6 +238,15 @@ export async function retryAgentRun(
   return { run, ...(jobId ? { jobId } : {}), createdThread: false }
 }
 
+function assertSandboxExecutionAvailable(thread: AgentThreadRecord): void {
+  if (thread.sandboxState && !["new", "ready"].includes(thread.sandboxState.status)) {
+    throw new AgentRequestError(
+      "sandbox_execution_unavailable",
+      "[Sixb] Sandbox recovery is required before another run. Reload the thread and explicitly recreate it to start fresh."
+    )
+  }
+}
+
 async function assertAiLimitPreflight(
   runtime: SixbRuntimeContext,
   execution: Pick<ExecutionRecord, "requestedBy" | "requesterGroupIds">

package/src/agents/sandbox.ts

@@ -0,0 +1,44 @@
+import { getInvalidJsonValueReason, isPlainRecord } from "../json"
+import { OntologyValidationError } from "../ontology/errors"
+import type { OntologyRegistry } from "../ontology/registry"
+import type { SandboxDefinition } from "../sandboxes/configuration"
+import { normalizeParams } from "../shared/params/validation"
+import type { AgentThreadSandboxParams } from "../storage/agents/types"
+import { AgentRequestError } from "./errors"
+
+export function normalizeSandboxBinding(
+  definition: Pick<SandboxDefinition, "params"> | undefined,
+  input: unknown,
+  ontology: OntologyRegistry
+): AgentThreadSandboxParams {
+  if (!definition) {
+    throw new AgentRequestError(
+      "sandbox_not_configured",
+      "[Sixb] This sandbox provider has no compatible thread configuration."
+    )
+  }
+  if (!isPlainRecord(input)) {
+    throw new AgentRequestError(
+      "invalid_sandbox_params",
+      "[Sixb] sandbox must be an object containing the declared parameter values."
+    )
+  }
+  try {
+    const params = normalizeParams(ontology.getValueTypesById(), definition.params, input, {
+      kind: "sandbox",
+      id: "sandboxes",
+      path: "sandbox",
+    })
+    if (getInvalidJsonValueReason(params)) {
+      throw new OntologyValidationError("[Sixb] Sandbox params must normalize to JSON values.")
+    }
+    return params
+  } catch (error) {
+    throw new AgentRequestError(
+      "invalid_sandbox_params",
+      error instanceof OntologyValidationError
+        ? error.message
+        : "[Sixb] Sandbox params could not be normalized."
+    )
+  }
+}

package/src/agents/validation.ts

@@ -1,23 +1,12 @@
 import { getInvalidJsonValueReason, isPlainRecord, type JsonValue } from "../json"
 import { type ObjectSchema, OntologyValidationError, type ValueType } from "../ontology"
+import { assertValidSchema } from "../ontology/validation/definition"
 import { normalizeSchemaValue } from "../ontology/validation/normalize"
 import { validateSchemaValue } from "../ontology/validation/schema"
 import { AgentDefinitionError } from "./errors"
 import type { AgentToolDefinition, AgentToolInputSchema } from "./types"
 
 const AGENT_TOOL_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_-]{0,63}$/
-const AGENT_TOOL_PRIMITIVE_SCHEMAS = new Set([
-  "string",
-  "integer",
-  "double",
-  "decimal",
-  "boolean",
-  "date",
-  "timestamp",
-  "uuid",
-  "fileRef",
-])
-
 export const AGENT_RESERVED_TOOL_NAMES = [
   "bash",
   "read",
@@ -65,7 +54,7 @@ export function assertValidAgentToolInput(name: string, input: unknown): void {
         `[Sixb] Agent tool '${name}' input field names must not be empty.`
       )
     }
-    assertValidAgentToolSchema(name, schema, `input.${field}`, new Set())
+    assertValidSchema(schema, `input.${field}`, (path) => invalidAgentToolSchema(name, path))
   }
 }
 
@@ -115,80 +104,6 @@ export function validateAndNormalizeAgentToolInput(
   )
 }
 
-function assertValidAgentToolSchema(
-  toolName: string,
-  schema: unknown,
-  path: string,
-  visiting: Set<object>
-): void {
-  if (typeof schema === "string") {
-    if (AGENT_TOOL_PRIMITIVE_SCHEMAS.has(schema)) {
-      return
-    }
-    throw invalidAgentToolSchema(toolName, path)
-  }
-  if (!isPlainRecord(schema) || typeof schema.type !== "string" || visiting.has(schema)) {
-    throw invalidAgentToolSchema(toolName, path)
-  }
-
-  visiting.add(schema)
-  switch (schema.type) {
-    case "enum": {
-      const values = schema.values
-      const validValues = isValidAgentToolEnumValues(values, schema.valueType)
-      if (!validValues || new Set(values).size !== values.length) {
-        throw invalidAgentToolSchema(toolName, path)
-      }
-      break
-    }
-    case "array":
-      assertValidAgentToolSchema(toolName, schema.items, `${path}.items`, visiting)
-      break
-    case "map":
-      if (schema.keySchema !== "string") {
-        throw invalidAgentToolSchema(toolName, path)
-      }
-      assertValidAgentToolSchema(toolName, schema.valueSchema, `${path}.valueSchema`, visiting)
-      break
-    case "object": {
-      if (!isPlainRecord(schema.properties)) {
-        throw invalidAgentToolSchema(toolName, path)
-      }
-      for (const [fieldId, field] of Object.entries(schema.properties)) {
-        if (!fieldId.trim() || !isPlainRecord(field) || !("schema" in field)) {
-          throw invalidAgentToolSchema(toolName, `${path}.properties.${fieldId}`)
-        }
-        if (
-          (field.required !== undefined && typeof field.required !== "boolean") ||
-          (field.nullable !== undefined && typeof field.nullable !== "boolean") ||
-          (field.description !== undefined &&
-            (typeof field.description !== "string" || !field.description.trim()))
-        ) {
-          throw invalidAgentToolSchema(toolName, `${path}.properties.${fieldId}`)
-        }
-        assertValidAgentToolSchema(
-          toolName,
-          field.schema,
-          `${path}.properties.${fieldId}.schema`,
-          visiting
-        )
-      }
-      break
-    }
-    case "valueTypeRef":
-      if (typeof schema.valueTypeId !== "string" || !schema.valueTypeId.trim()) {
-        throw invalidAgentToolSchema(toolName, path)
-      }
-      if (schema._resolved !== undefined) {
-        assertValidAgentToolSchema(toolName, schema._resolved, `${path}._resolved`, visiting)
-      }
-      break
-    default:
-      throw invalidAgentToolSchema(toolName, path)
-  }
-  visiting.delete(schema)
-}
-
 function invalidAgentToolSchema(toolName: string, path: string): AgentDefinitionError {
   return new AgentDefinitionError(
     `[Sixb] Agent tool '${toolName}' ${path} must be a valid Sixb schema.`
@@ -219,27 +134,6 @@ export function assertValidProjectAgentToolDefinitions(
   }
 }
 
-function isValidAgentToolEnumValues(values: unknown, valueType: unknown): values is unknown[] {
-  if (!Array.isArray(values) || values.length === 0) {
-    return false
-  }
-
-  for (let index = 0; index < values.length; index += 1) {
-    if (!Object.hasOwn(values, index)) {
-      return false
-    }
-    const value = values[index]
-    if (
-      valueType === "string"
-        ? typeof value !== "string"
-        : valueType !== "integer" || typeof value !== "number" || !Number.isInteger(value)
-    ) {
-      return false
-    }
-  }
-  return true
-}
-
 function deepFreeze<T>(value: T, seen: Set<object> = new Set()): T {
   if (value === null || typeof value !== "object" || seen.has(value)) {
     return value

package/src/datasets/validation.ts

@@ -1,4 +1,5 @@
 import { isFileRef } from "../blob-storage"
+import { withFailureMessage } from "../errors/failure-message"
 import { isJsonValue, isPlainRecord } from "../json"
 import { isDecimalString } from "../ontology/decimal"
 import { DatasetValidationError } from "./errors"
@@ -233,8 +234,17 @@ export function getDatasetRowValidationError(
   dataset: DatasetDefinition,
   options?: { readonly columns?: Iterable<string> }
 ): string | null {
+  return getDatasetRowValidationFailure(row, dataset, options)?.message ?? null
+}
+
+/** Internal form retains a value-free explanation for the durable failure boundary. */
+export function getDatasetRowValidationFailure(
+  row: unknown,
+  dataset: DatasetDefinition,
+  options?: { readonly columns?: Iterable<string> }
+): Error | null {
   if (!isPlainRecord(row)) {
-    return `Dataset '${dataset.id}' rows must be plain objects.`
+    return rowFailure(`Dataset '${dataset.id}' rows must be plain objects.`)
   }
 
   const columnsByName = new Map(
@@ -251,7 +261,7 @@ export function getDatasetRowValidationError(
         continue
       }
 
-      const error = getColumnValidationError(row, column, dataset)
+      const error = getColumnValidationFailure(row, column, dataset)
       if (error) {
         return error
       }
@@ -262,12 +272,15 @@ export function getDatasetRowValidationError(
 
   for (const columnName of Object.keys(row)) {
     if (!columnsByName.has(columnName)) {
-      return `Dataset '${dataset.id}' row contains unknown column '${columnName}'.`
+      return rowFailure(
+        `Dataset '${dataset.id}' row contains unknown column '${columnName}'.`,
+        `Dataset '${dataset.id}' row contains an undeclared column.`
+      )
     }
   }
 
   for (const column of dataset.schema.columns) {
-    const error = getColumnValidationError(row, column, dataset)
+    const error = getColumnValidationFailure(row, column, dataset)
     if (error) {
       return error
     }
@@ -276,29 +289,37 @@ export function getDatasetRowValidationError(
   return null
 }
 
-function getColumnValidationError(
+function getColumnValidationFailure(
   row: Record<string, unknown>,
   column: DatasetColumnDefinition,
   dataset: DatasetDefinition
-): string | null {
+): Error | null {
   const hasValue = Object.hasOwn(row, column.name)
   const value = row[column.name]
   if (column.name === dataset.sequenceBy) {
-    return getDatasetSequenceValidationError(dataset, value)
+    const message = getDatasetSequenceValidationError(dataset, value)
+    return message === null
+      ? null
+      : rowFailure(
+          message,
+          `Dataset '${dataset.id}' sequence column '${column.name}' must contain a valid ${column.type} source sequence.`
+        )
   }
 
   // Treat `undefined` the same as an omitted field so callers either send a real
   // value or use `null` explicitly on nullable columns.
   if (!hasValue || value === undefined) {
     if (!column.nullable) {
-      return `Dataset '${dataset.id}' row is missing required column '${column.name}'.`
+      return rowFailure(`Dataset '${dataset.id}' row is missing required column '${column.name}'.`)
     }
     return null
   }
 
   if (value === null) {
     if (!column.nullable) {
-      return `Dataset '${dataset.id}' column '${column.name}' does not allow null values.`
+      return rowFailure(
+        `Dataset '${dataset.id}' column '${column.name}' does not allow null values.`
+      )
     }
     return null
   }
@@ -307,13 +328,21 @@ function getColumnValidationError(
   // Reject ambiguous or lossy values before staging, even when another column orders the row.
   if (dataset.sequenceBy !== undefined && column.type === "timestamp") {
     return parseDatasetTimestamp(value) === null
-      ? `Dataset '${dataset.id}' column '${column.name}' must be a valid Date or ISO timestamp with an explicit timezone and at most millisecond precision.`
+      ? rowFailure(
+          `Dataset '${dataset.id}' column '${column.name}' must be a valid Date or ISO timestamp with an explicit timezone and at most millisecond precision.`
+        )
       : null
   }
 
   if (!matchesColumnType(value, column.type)) {
-    return `Dataset '${dataset.id}' column '${column.name}' must match type '${column.type}'.`
+    return rowFailure(
+      `Dataset '${dataset.id}' column '${column.name}' must match type '${column.type}'.`
+    )
   }
 
   return null
 }
+
+function rowFailure(message: string, publicMessage = message): Error {
+  return withFailureMessage(new DatasetValidationError(message), publicMessage)
+}